Linux Permissions

rwx

Permissions

At a basic level, permissions in Linux are a relationship between users, groups, files, and directories. Users can belong to multiple groups and groups can have multiple users. Every file and directory defines its permissions in terms of a user, a group, and "others" (all other users).

Users

User accounts are configured in the /etc/passwd file. User password hashes are stored in the /etc/shadow file. Users are identified by an integer user ID (UID). The "root" user account is a special type of account in Linux. It has an UID of 0, and the system grants this user access to every file.

Groups

Groups are configured in the /etc/group file. Users have a primary group, and can have multiple secondary (or supplementary) groups. By default, an user's primary group has the same name as their user account.

Files and Directories

All files & directories have a single owner and a group. Permissions are defined in terms of read, write, and execute operations. There are three sets of permissions, one for the owner, one for the group, and one for all "other" users (can also be referred to as "world"). Only the owner can change permissions.

File Permissions

File permissions are self explanatory:

• Read

  • When set, the file contents can be read.

• Write

  • When set, the file contents can be modified.

• Execute

  • When set, the file can be executed (i.e. run as some kind of process).

Directory Permissions

Directory permissions are slightly more complicated:

• Execute

  • When set, the directory can be entered. Without this permission, neither the read nor write permissions will work.

• Read

  • When set, the directory contents can be listed.

• Write

  • When set, files and subdirectories can be created in the directory.

Special Permissions

• Setuid (SUID) bit

  • When set, files will get executed with the privileges of the file owner.

• Setgid (SGID) bit

  • When set on a file, the file will get executed with the privileges of the file group.

  • When set on a directory, files created within that directory will inherit the group of the directory itself.

Viewing Permissions

The ls command can be used to view permissions:

View permissions

The first 10 characters indicate the permissions set on the file or directory. The first character simply indicates the type (e.g. - for file, d for directory). The remaining 9 characters represent the 3 sets of permissions (owner, group, others). Each set contains 3 characters, indicating the read (r), write (w), and execute (x) permissions. SUID/SGID permissions are represented by an s in the execute position.

Real, Effective, and Saved UID/GID

Each user has 3 user IDs in Linux (real, effective, and saved).

A user's real ID is who they actually are (the ID defined in /etc/passwd). Ironically, the real ID is actually used less often to check a user's identity.

A user's effective ID is normally equal to their real ID, however when executing a process as another user, the effective ID is set to that user's real ID. The effective ID is used in most access control decisions to verify a user, and commands such as whoami use the effective ID.

Finally, the saved ID is used to ensure that SUID processes can temporarily switch a user's effective ID back to their real ID and back again without losing track of the original effective ID.

Examples

Print real and effective user/group IDs:

Print real and effective user/group IDs

Print real, effective, saved, and file system user/group IDs of the current process (i.e. our shell):

Print real, effective, saved, and file system user/group IDs of the current process (i.e. our shell)